Selected scope
The authorisation condition for a specified connection-state action.
Control Module Control Plan
Validate · CP-05Approval-gated connection changes
Adopt Validate through an assessed approval integration before a selected connection changes; approval assurance remains distinct from boundary sequencing.
The asset owner defines approvers, request purpose and supporting identity or approval evidence.
Incident
Path exposed
Outcome
Control taken
Approximately 120–150 ms
Management enable/disable operation
Around 2–3 seconds
SMS round-trip operation, good signal
March 2025 test observations, not guaranteed timings.
01The problem
Establish the required approval. Before the connection changes.
Validate governs whether a selected connection-state change has the required authorisation, using the configured supporting approval process.
Distinction
Lock enforces access conditions at a protected boundary. Validate addresses approval before the action; it is not proof that the physical state changed.
02How Validate is adopted
Externally approved connection change. Agreed before it is needed.
Physical connection control on a selected path, governed by an assessed external approval workflow.
Normal connection behaviour
A new opening requires the approvals defined for the unchanged task, target and duration.
The physical action
The integrated workflow releases a state-change instruction only after the required approvals.
Restoration
Every new opening requires current approvals; evidence of approval and evidence of physical state are checked separately.
What this Plan defines
- Named independent approvers establish the same unchanged task, target and duration in supporting systems.
- The required current approvals permit release of the connection-state instruction.
- The registered crossing, permitted states and acceptance checks.
What it does not do
- Identity, multi-party approval and certificates are not assumed native features. The chosen integrations and the evidence they provide must be validated.
- Act on crossings outside the registered scope.
- Provide storage, backup, recovery or content inspection.
03See it work
Three illustrative crossings. One authorised Validate change.
Follow an illustrative Validate adoption from normal operation to restoration. Only the selected crossing changes; the others keep their assessed states.
Outside
Remote accessVPN and remote desktop gateway
Vendor supportEquipment vendor’s remote support
Corporate IT
Corporate ITUsers, servers and identity
Operations
Control systemsSCADA, PLCs, controllers and HMIs
EngineeringEngineering workstations
Stage
Normal operation
A new opening requires the approvals defined for the unchanged task, target and duration.
Named independent approvers establish the same unchanged task, target and duration in supporting systems.
- Commanded
- No change.
- Reported by the control point
- C1, C2 and C3 in their registered states.
- Independently verified
- Matches the state confirmed at the last test.
Selected crossing
Validate · CP-01 Approval-gated connection changesRemote access to corporate IT · Cyber, IT- Normal state
- Connected for staff and administrators.
- What changes it
- The required current approvals permit release of the connection-state instruction.
- What Validate does
- The integrated workflow releases a state-change instruction only after the required approvals.
Concept illustration. Choose a stage, or a crossing on the map. Commanded, reported and verified states are shown separately because they are not the same thing. Crossings, states and owners are agreed for your estate.
04Before you rely on it
Agreed in advance. Tested before it counts.
This Plan works because the decisions are made in advance: which crossing, which state, who authorises it and what must keep running.
Before you rely on it
What has to be true first.
- The runbook names each crossing, its action and who can order it.
- In OT and CNI, the plant reaches a safe state before a route is withdrawn.
- Routes not in the runbook are not acted on.
- Each action is tested in a planned window before you rely on it.
- Wireless, cellular and other routes outside the plan need their own controls.
Other arrangements to assess
Candidates, not included capabilities.
- Just-in-time connection window. A Firebreak on the selected maintenance, supplier or change path.
Validate identity, independent authorisers, request integrity, expiry, emergency exceptions and evidence. Certificates and four-eye approval are not assumed native Control features.
Authority and trigger
Named independent approvers establish the same unchanged task, target and duration in supporting systems.
The required current approvals permit release of the connection-state instruction.
Conditions to validate
Validate identity, independent authorisers, request integrity, expiry, emergency exceptions and evidence. Certificates and four-eye approval are not assumed native Control features.
05Questions
Straight answers.
For incident owners, responders and operations.
Why is Validate the solution behind this Plan?
Validate owns the connection authorisation and assurance solution. This Plan defines one way to adopt it: Physical connection control on a selected path, governed by an assessed external approval workflow.
Who authorises a change?
Named independent approvers establish the same unchanged task, target and duration in supporting systems.
What triggers it?
The required current approvals permit release of the connection-state instruction.
How is the connection restored?
Every new opening requires current approvals; evidence of approval and evidence of physical state are checked separately.
What does it not do?
Identity, multi-party approval and certificates are not assumed native features. The chosen integrations and the evidence they provide must be validated.
Is this a validated installation?
No. It is an assessment approach informed by documented deployment patterns. Applicability is confirmed for your estate in a discovery session and acceptance tests.
06Your next step
Name the crossing Validate should govern first.
Bring the connection you are most concerned about. We will map the crossing, agree what must keep running, and tell you plainly whether this Validate approach fits.
Discuss this adoption approachOr see all nine Modules